As part of our ongoing efforts to help companies combat email-borne security threats, we are pleased to introduce a customizable SPF (Sender Policy Framework) check to the MAX MailProtection service.

SPF is a proven methodology that can help prevent spoofed (forged) messages from reaching a customer’s email infrastructure. It provides both a layer of validation of incoming email from legitimate third-party senders, and an additional method of detecting fraudulent email, including messages purporting to be from a customer’s own domain.

Within MAX MailProtection, all inbound messages are subject to an SPF check that compares the sending IP address for a message with the published SPF records within the DNS record for the sending domain name.  When that comparison is done:

• If the sending domain has no SPF records within its DNS record, the SPF check will have no impact
• If the sending domain has SPF records that match the sending IP address of the email, MAX MailProtection will tend to trust that the message is authentic (although the message will still be scanned by all of MAX Mail’s standard anti-spam and anti-virus engines)
• If the SPF check determines that the message was sent from an IP address different from the authorized IP addresses published for the sending domain, then that message can be blocked outright, or handled as otherwise determined by the customer.

The handling of messages that fail an SPF check can be configured by the customer within the Management > Inbound Filtering > Additional Blocking Rules section of the control panel.  By default, messages that fail an SPF check will only be automatically designated as spam for users with a ‘very high’ aggressiveness set for their filtering.  Customers may wish to:

• Configure the SPF check to automatically treat these messages as spam
• Issue a temporarily deferral to the sender, or
• Permanently bounce the message

Customers are welcome to contact our support team for a copy of our SPF Guide or for any assistance with these settings.

We recommend that customers create an SPF record in their public DNS records if they have not already done so, to help prevent spoofed messages from their domain(s).  Instructions on how to do this are also included in our SPF Guide. Please feel free to contact our support team if we can assist with creating the SPF record.

Thanks for your attention.